Aleksa Sarai
1571af50e2
<https://github.com/docker/buildx/releases/tag/v0.28.0> - Update to Docker 28.4.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/28/#2840> - Rebased patches: * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/docker?expand=0&rev=450
74 lines
2.6 KiB
Diff
74 lines
2.6 KiB
Diff
From 6f03d8d6c52c95823d5d730416b2b8b111a9f2a3 Mon Sep 17 00:00:00 2001
|
|
From: Aleksa Sarai <asarai@suse.de>
|
|
Date: Wed, 8 Mar 2017 12:41:54 +1100
|
|
Subject: [PATCH 2/6] SECRETS: daemon: allow directory creation in /run/secrets
|
|
|
|
Since FileMode can have the directory bit set, allow a SecretStore
|
|
implementation to return secrets that are actually directories. This is
|
|
useful for creating directories and subdirectories of secrets.
|
|
|
|
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
|
|
Signed-off-by: Aleksa Sarai <asarai@suse.de>
|
|
---
|
|
daemon/container_operations_unix.go | 23 ++++++++++++++++++++---
|
|
1 file changed, 20 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/daemon/container_operations_unix.go b/daemon/container_operations_unix.go
|
|
index f6d9449609b7..520b7f80f162 100644
|
|
--- a/daemon/container_operations_unix.go
|
|
+++ b/daemon/container_operations_unix.go
|
|
@@ -3,6 +3,7 @@
|
|
package daemon
|
|
|
|
import (
|
|
+ "bytes"
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
@@ -21,6 +22,7 @@ import (
|
|
"github.com/docker/docker/libnetwork/drivers/bridge"
|
|
"github.com/docker/docker/pkg/process"
|
|
"github.com/docker/docker/pkg/stringid"
|
|
+ "github.com/moby/go-archive"
|
|
"github.com/moby/sys/mount"
|
|
"github.com/moby/sys/user"
|
|
"github.com/opencontainers/selinux/go-selinux/label"
|
|
@@ -325,9 +327,6 @@ func (daemon *Daemon) setupSecretDir(ctr *container.Container) (setupErr error)
|
|
if err != nil {
|
|
return errors.Wrap(err, "unable to get secret from secret store")
|
|
}
|
|
- if err := os.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
|
|
- return errors.Wrap(err, "error injecting secret")
|
|
- }
|
|
|
|
uid, err := strconv.Atoi(s.File.UID)
|
|
if err != nil {
|
|
@@ -338,6 +337,24 @@ func (daemon *Daemon) setupSecretDir(ctr *container.Container) (setupErr error)
|
|
return err
|
|
}
|
|
|
|
+ if s.File.Mode.IsDir() {
|
|
+ if err := os.Mkdir(fPath, s.File.Mode); err != nil {
|
|
+ return errors.Wrap(err, "error creating secretdir")
|
|
+ }
|
|
+ if secret.Spec.Data != nil {
|
|
+ // If the "file" is a directory, then s.File.Data is actually a tar
|
|
+ // archive of the directory. So we just do a tar extraction here.
|
|
+ if err := archive.UntarUncompressed(bytes.NewBuffer(secret.Spec.Data), fPath, &archive.TarOptions{
|
|
+ IDMap: daemon.idMapping,
|
|
+ }); err != nil {
|
|
+ return errors.Wrap(err, "error injecting secretdir")
|
|
+ }
|
|
+ }
|
|
+ } else {
|
|
+ if err := os.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
|
|
+ return errors.Wrap(err, "error injecting secret")
|
|
+ }
|
|
+ }
|
|
if err := os.Chown(fPath, ruid+uid, rgid+gid); err != nil {
|
|
return errors.Wrap(err, "error setting ownership for secret")
|
|
}
|
|
--
|
|
2.51.0
|
|
|